Privacy policy

(a) Policy required A covered entity shall maintain a privacy policy relating to the practices of such entity regarding the collecting, processing, maintaining, and disclosing of personal information. (b) Contents The privacy policy required by subsection (a) shall contain the following: (1) A general description of the practices of the covered entity regarding the collecting, processing, maintaining, and disclosing of personal information. (2) A description of how individuals may exercise the rights provided by title I. (3) A clear and concise summary of the following: (A) The categories of personal information collected or otherwise obtained by the covered entity. (B) The business or commercial purposes of the covered entity for collecting, processing, maintaining, or disclosing personal information. (C) The categories and a list of third parties to which the covered entity discloses personal information. (4) A description of the personal information that the covered entity maintains that the covered entity does not collect from individuals and how the covered entity obtains such personal information. (5) A list of the third parties to which the covered entity has disclosed personal information. (6) A list of the third parties from which the covered entity has obtained personal information at any time on or after the effective date of this Act. (7) The articulated basis for the collecting, processing, disclosing, and maintaining of personal information, as required under section 201(a). (c) Exemption for personal information for particular purposes The privacy policy required by subsection (a) is not required to contain information relating to personal information that is collected, processed, maintained, or disclosed exclusively for any of the purposes described in paragraph (1) of section 109(a) (or a combination of such purposes), except as provided in paragraph (2) of such section. (d) Availability of privacy policy (1) Form and manner The privacy policy required by subsection (a) shall be— (A) clear and in plain language; and (B) made publicly available in a prominent location on an ongoing basis. (2) Timing The privacy policy required by subsection (a) shall be made available as required by paragraph (1) before the covered entity collects personal information after the effective date of this Act. (e) Small businesses excluded Subsections (b)(7) and (d) do not apply to a small business. (f) Service providers excluded This section does not apply to a service provider if such service provider has a reasonable belief that a covered entity for which it processes, maintains, or discloses personal information is in compliance with this section.